ci: add cppcheck + AddressSanitizer + CodeQL quality CI

[dvershinin]

Summary

Brings this module up to the quality bar established by ngx_nftset_access_module PR #1. Runner-direct path (no Docker base image) — the existing build.yml already follows that pattern, so less new infrastructure to maintain.

• cppcheck — static-analysis.yml's cppcheck job apt-installs cppcheck, git-clones the same release-1.27.2 nginx tree the test workflow uses, configures it so headers resolve under /tmp/nginx-src/objs, then lints src/ngx_http_security_headers_module.c at --check-level=exhaustive. .cppcheck-suppressions only mutes noise (missingIncludeSystem, unusedFunction, unmatchedSuppression).
• AddressSanitizer — new test-asan job in build.yml. Rebuilds nginx with --add-module (static) under -fsanitize=address, runs the existing Test::Nginx suite. detect_leaks=0 avoids benign LSAN false positives at shutdown; post-prove the step greps /tmp/asan/asan.* and fails on any report.
• CodeQL — static-analysis.yml's codeql job. This is a public repo, so analyze@v3 uploads SARIF normally to the Security tab; permissions: { security-events: write } — the regular path, not the private-repo upload: never + SARIF gate. Important to validate this branch of the quality-CI pattern in week 1 of the rollout.

Also tightens .gitignore for CLAUDE.md, .cursor/, test-error.log so the working tree stays clean across sessions.

Test plan

• cppcheck (ad-hoc, via the sibling sorted_args base image which already had cppcheck + nginx headers cached) — clean (zero findings).
• ASAN suite (ad-hoc, same image): 108 tests pass across config.t + headers.t, exit 0, zero ASAN/UBSan reports.
• CI passes: existing build matrix (stable + mainline), new test-asan, cppcheck, codeql (with upload to Security tab).

Part of the weekly GetPageSpeed nginx-module quality-CI rollout. First public repo in the rollout.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.